Delores (Thimbleweed Park new free Mini-Adventure)

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

How unpack/repack?
thimbleweed_park.bms ask for "MEMORY_FILE10" and engge.exe not done any output or log.
atom0s
Posts: 250
Joined: Sat Dec 27, 2014 8:49 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by atom0s »

Here's a modded version of the thimbleweed_park.bms for this game:

Code: Select all

# Delores: A Thimbleweed Park Mini-Adventure (script 0.1.2)
#   select R when quickbms will ask about files that already exist
# script for QuickBMS http://quickbms.aluigi.org

quickbmsver "0.8.0"

set KEY binary "\x3F\x41\x41\x60\x95\x87\x4A\xE6\x34\xC6\x3A\x86\x29\x27\x77\x8D\x38\xB4\x96\xC9\x38\xB4\x96\xC9\x00\xE0\x0A\xC6\x00\xE0\x0A\xC6\x00\x3C\x1C\xC6\x00\x3C\x1C\xC6\x00\xE4\x40\xC6\x00\xE4\x40\xC6 "

# https://github.com/mstr-/twp-ggdump/blob/master/ggdump/ggdump.py
set MEMORY_FILE10 string "
    void decode_unbreakable_xor(unsigned char *magic_bytes, unsigned char *buffer, int buf_len) {
        unsigned char var4 = buf_len;
        int     c;
        for(int i = 0; i < buf_len; i++) {
            buffer[i] ^= (((i & 0xFF) * 0x6D) ^ magic_bytes[i & 0x0F]) ^ var4;
            var4 ^= buffer[i];
        }
    }
"

encryption calldll "MEMORY_FILE10 decode_unbreakable_xor tcc RET KEY #INPUT# #INPUT_SIZE#"

get data_offset long
get data_size long
log MEMORY_FILE data_offset data_size

idstring MEMORY_FILE "\x01\x02\x03\x04"
get DUMMY long MEMORY_FILE
get NAMES_OFF long MEMORY_FILE
math NAMES_OFF + 1

/*
# boring opcode stuff...
for
    get OPCODE byte MEMORY_FILE
    if OPCODE == 2

        savepos TMP MEMORY_FILE
        goto NAMES_OFF MEMORY_FILE
        get NAME_OFF long MEMORY_FILE
        savepos NAMES_OFF MEMORY_FILE
        goto NAME_OFF MEMORY_FILE
        get NAME string MEMORY_FILE
        goto TMP MEMORY_FILE

        get DUMMY long MEMORY_FILE
        get DUMMY long MEMORY_FILE

    elif OPCODE == 3

        get DUMMY long MEMORY_FILE  # number of files

    elif OPCODE == 4

        get DUMMY long MEMORY_FILE
        get DUMMY long MEMORY_FILE

    elif OPCODE == 5

        get DUMMY long MEMORY_FILE
        get DUMMY long MEMORY_FILE
        get DUMMY byte MEMORY_FILE
        get DUMMY long MEMORY_FILE
        get DUMMY byte MEMORY_FILE

    else

        cleanexit

    endif
next
*/

set NAME string ""
math XOFFSET = 0
math XSIZE   = 0

goto NAMES_OFF MEMORY_FILE
for i = 0
    get NAME_OFF long MEMORY_FILE
    if NAME_OFF == 0xffffffff
        break
    endif
    savepos TMP MEMORY_FILE
    goto NAME_OFF MEMORY_FILE
    get STR string MEMORY_FILE
    goto TMP MEMORY_FILE

      if STR == "files"
    elif STR == "filename"
    elif STR == "offset"
    elif STR == "size"
    else
        # 0:name, 1:offset, 2:size
        # BUT sometimes SIZE is not specified so let's guess it

        math TMP = i
        math i + 1
        math TMP % 3
        if TMP == 0
            set NAME string STR
        elif TMP == 1
            math XOFFSET = STR
        elif TMP == 2
            math TMP = STR
            if TMP == 0
                set NAME string STR
                math i + 1
                # take the old XSIZE
            else
                math XSIZE = STR
            endif
            log NAME XOFFSET XSIZE
        endif
    endif
next



Just the magic bytes key changed.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by aluigi »

Well done, I update the script for testing both the keys.
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

atom0s wrote:Here's a modded version of the thimbleweed_park.bms for this game:

Code: Select all

# Delores: 
[...]


Just the magic bytes key changed.

Thanks, very apreciated
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

aluigi wrote:Well done, I update the script for testing both the keys.

Seems not working anymore with first Thimbleweed.
And no mod accepted in recompiled Delores, not even in hex.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by aluigi »

Can you provide a sample file for me to test?
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

Here original file (Delores0.ggpack1) and repacked file Delores.ggpack1 with reimported "Natalie.yack", only one untuched file; the game is free:
https://drive.google.com/open?id=1AhQfO ... Pr0srlJpBY

Trying exportig ThimbleweedPark.ggpack1 of first game, instead:

Code: Select all

Error: [myfseek] offset 0x0d04c6e7 in file -1 can't be reached

Last script line before the error or that produced the error:
  92  goto NAME_OFF MEMORY_FILE

And with other ThimbleweedPark.ggpack2 file:

Code: Select all

- library MEMORY_FILE10 loaded at address 05E0AED8
- function found at offset 05E01800
  00000000 0          bffset

-------------------
*EXCEPTION HANDLER*
-------------------
An error or crash occurred:

*EH* ExceptionCode      c0000005 access violation
*EH* ExceptionFlags     00000000
*EH* ExceptionAddress   05E01874
*EH* NumberParameters   00000002
*EH*                    00000001
*EH*                    00B556DE

Last script line before the error or that produced the error:
  121 endif



Thank you for your support.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by aluigi »

The script works perfectly with the Delores*.ggpack1 samples you provided.
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

It extract files, but it have problem reimporting.
This are files wich I've provided (the differences between original and "modded" with reimported untuched file):

Image

And this is the problem:

Image

...so "perfectly" not.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by aluigi »

Because the decryption function is just for decrypting so it corrupts the data when you reimport the files.
So, yes, extraction is perfect.

I have just made a new version of the script that allows reimporting.
The only thing you must do is uncommenting (removing the initial #) line 37.
Just tested and the extracted files from the reimported ggpack1 are perfect.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by aluigi »

Ah, remember that you must use reimport.bat which is limited by the size of the original file.
The reason is that the table is encrypted and cannot be modified.
I don't know if the game is going to accepted the edited files, if it uses a checksum then you can't do much.
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

Great! No checksum.
I always use your reimport.bat
Thanks
Last edited by Rulesless on Fri May 15, 2020 1:03 am, edited 2 times in total.
Rulesless
Posts: 39
Joined: Mon Mar 02, 2020 3:32 am

Re: Delores (Thimbleweed Park new free Mini-Adventure)

Post by Rulesless »

Someone knows if .dink files can only be edited in hex?